[JAMES-1734] As an authenticated JMAP user, I can prentend to be someone else in the mails I send

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Trunk
• Fix Version/s: Trunk
• Component/s: JMAP
• Assignee: Benoit Tellier
• Reporter: Benoit Tellier
• Created: 05/May/16 08:26
• Updated: 19/May/16 02:30
• Resolved: 19/May/16 02:30

Description

Scenario :

Bob and Alice are together an happy couple. William is jaleaous of this. He decides to send a mail to Alice, with Bob identity to tell her Bob decided to brake up.

To do this, Bob proceide a JMAP post on setMessages endpoint on outbox. He then uses bob address in the from field.

Alice will receive a mail from bob saying they broke up. And she will believe it, cry all the night and meet William.

Code snipsets : failing test :

```
@Test
public void test() throws Exception {
jmapServer.serverProbe().createMailbox(MailboxConstants.USER_NAMESPACE, username, "sent");
jmapServer.serverProbe().addUser("[e-mail]", "1234");
jmapServer.serverProbe().addUser("[e-mail]", "1234");

String requestBody = "[" +
" [" +
" \"setMessages\","+
" {" +
" \"create\": { \"user|inbox|1\" : {" +
" \"from\":

{ \"email\": \"[e-mail]\"}

," +
" \"to\": [

{ \"name\": \"Alice\", \"email\": \"[e-mail]\"}

]," +
" \"cc\": [

{ \"name\": \"ALICE\"}

]," +
" \"subject\": \"Alice, I break up with you !\"," +
" \"textBody\": \"In this mail [e-mail] pretends to be [e-mail], and takes advantage of it\"," +
" \"mailboxIds\": [\"" + getOutboxId() + "\"]" +
" }}" +
" }," +
" \"#0\"" +
" ]" +
"]";

// Given
given()
.accept(ContentType.JSON)
.contentType(ContentType.JSON)
.header("Authorization", accessToken.serialize())
.body(requestBody)
// When
.when()
.post("/jmap")
.prettyPeek();

// Then
AccessToken user2AccessToken = accessToken = JmapAuthentication.authenticateJamesUser("[e-mail]", "1234");

Thread.sleep(10000);

with()
.accept(ContentType.JSON)
.contentType(ContentType.JSON)
.header("Authorization", user2AccessToken.serialize())
.body("[[\"getMessageList\",

{\"fetchMessages\":true, \"fetchMessageProperties\":[\"from\", \"subject\", \"textBody\"]}

, \"#0\"]]")
.when()
.post("/jmap")
.prettyPeek();
}
```

Jmap responses :

William :

```
[
[
"messagesSet",
{
"accountId": null,
"oldState": null,
"newState": null,
"created": {
"user|inbox|1": {
"id": "[e-mail]|outbox|1",
"blobId": "1",
"threadId": "[e-mail]|outbox|1",
"mailboxIds": [
"cf265170-1299-11e6-9382-c5a352d114a2"
],
"inReplyToMessageId": null,
"isUnread": false,
"isFlagged": false,
"isAnswered": false,
"isDraft": false,
"hasAttachment": false,
"headers":

{ "cc": " ", "date": "Thu, 5 May 2016 15:17:29 +0700", "bcc": " ", "sender": "[e-mail]", "subject": "Alice, I break up with you !", "message-id": "user|inbox|1", "from": "[e-mail]", "to": "Alice <[e-mail]>", "reply-to": " " }

,
"from":

{ "name": "[e-mail]", "email": "[e-mail]" }

,
"to": [

{ "name": "Alice", "email": "[e-mail]" }

],
"cc": [

],
"bcc": [

],
"replyTo": [

],
"subject": "Alice, I break up with you !",
"date": "2016-05-05T08:17:29.974Z",
"size": 297,
"preview": "In this mail [e-mail] pretends to be [e-mail], and takes advantage of it",
"textBody": "In this mail [e-mail] pretends to be [e-mail], and takes advantage of it",
"htmlBody": null,
"attachments": [

],
"attachedMessages": {

}
}
},
"updated": [

],
"destroyed": [

],
"notCreated": {

},
"notUpdated": {

},
"notDestroyed": {

}
},
"#0"
]
]
```

Alice :

```
[
[
"messageList",

{ "accountId": null, "filter": null, "sort": [ ], "collapseThreads": false, "state": null, "canCalculateUpdates": false, "position": 0, "total": 0, "threadIds": [ ], "messageIds": [ "[e-mail]|INBOX|1" ] }

,
"#0"
],
[
"messages",
{
"notFound": [

],
"list": [
{
"id": "[e-mail]|INBOX|1",
"from":

{ "name": "[e-mail]", "email": "[e-mail]" }

,
"subject": "Alice, I break up with you !",
"textBody": "In this mail [e-mail] pretends to be [e-mail], and takes advantage of it"
}
]
},
"#0"
]
]
```